Nextcloud puts out fire after data leak panic

Open source software biz Nextcloud issued fixes to its software this week after bug hunters raised concerns about data collection. Mastodon user "Niels" was the first to notice some peculiar activity in their Nextcloud server logs after upgrading to version 31.0.0. Almost immediately after upgrading, they voiced concerns that …

[Kurgan]

Not good

While I have not delved into the complications of federated nextcloud servers, it's quite clear that the default configuration should be that every federation function is DISABLED and the server is completely isolated and nothing is accessible unless you are a logged in user (or you have received a share link for an object).

[Lon24]

Alpha, beta, gammon

Nextcloud's declared strategy is to quickly grab some of the office space occupied by Microsoft & Google with lots of enhancements and apps. Hence move fast and break stuff is the cost of development. This has led to some friction with the crabby old SysAdmins looking for just a very stable federated database. Folks like me hang back two versions (currently 29.0.13) to minimise bugs and only move up when support ends.

With four weekly point updates and a version life of just 12 months - new bugs are a way of life, particularly new versions. The clue is the trailing 0 in 31.0.0. Only a very brave idiot would put that into production. Pre-evaluation more like. So it won't have live users. Doesn't mean it has no real data though.

Nextcloud Release Schedule

[alcachofas]

Decent response

Reading that GitHub thread, this is an almost perfect example of how to acknowledge, handle and communicate around a serious issue.

This shouldn’t be a surprise but I’m so used now to deflection, weasel words and excuses, that the clear response and expected timelines are seriously good to see